aaspai-authx 0.0.2 → 0.0.4

package/dist/nest/index.cjs

@@ -107,26 +107,15 @@ function isPlainObject(value) {
 var PLATFORM_ROLES = [
   {
     role: "platform_admin",
-    permissions: [
-      "projects.create",
-      "projects.read",
-      "projects.update",
-      "projects.delete",
-      "users.manage",
-      "api.manage"
-    ]
+    permissions: []
   },
   {
     role: "platform_manager",
-    permissions: [
-      "projects.read",
-      "projects.update",
-      "users.read"
-    ]
+    permissions: []
   },
   {
     role: "platform_user",
-    permissions: ["projects.read"]
+    permissions: []
   }
 ];
 function getPermissionsForRoles(roles) {
@@ -184,17 +173,36 @@ function buildSession(payload) {
   return session;
 }
 
-// src/models/user.model.ts
+// src/models/rolePermission.model.ts
 var import_mongoose = __toESM(require("mongoose"), 1);
+var RolePermissionSchema = new import_mongoose.Schema(
+  {
+    orgId: { type: String, default: null, index: true },
+    role: { type: String, required: true },
+    permissions: { type: [String], default: [] }
+  },
+  {
+    timestamps: true
+  }
+);
+RolePermissionSchema.index({ orgId: 1, role: 1 }, { unique: true });
+var RolePermissionModel = import_mongoose.default.model(
+  "RolePermission",
+  RolePermissionSchema,
+  "role_permissions"
+);
+
+// src/models/user.model.ts
+var import_mongoose2 = __toESM(require("mongoose"), 1);
 var import_uuid = require("uuid");
-var MetadataSchema = new import_mongoose.default.Schema(
+var MetadataSchema = new import_mongoose2.default.Schema(
   {
     key: { type: String, required: true },
-    value: { type: import_mongoose.default.Schema.Types.Mixed, required: true }
+    value: { type: import_mongoose2.default.Schema.Types.Mixed, required: true }
   },
   { _id: false }
 );
-var OrgUserSchema = new import_mongoose.default.Schema(
+var OrgUserSchema = new import_mongoose2.default.Schema(
   {
     id: { type: String, default: (0, import_uuid.v4)(), index: true },
     email: { type: String, required: true, unique: true },
@@ -211,7 +219,7 @@ var OrgUserSchema = new import_mongoose.default.Schema(
   },
   { timestamps: true, collection: "users" }
 );
-var OrgUser = import_mongoose.default.model("OrgUser", OrgUserSchema);
+var OrgUser = import_mongoose2.default.model("OrgUser", OrgUserSchema);
 
 // src/utils/extract.ts
 var import_cookie = require("cookie");
@@ -276,6 +284,27 @@ function verifyJwt(token) {
 }
 
 // src/middlewares/auth.middleware.ts
+async function mergeRolePermissions(session) {
+  const roles = Array.isArray(session.roles) ? session.roles : [];
+  if (!roles.length) return;
+  const orgContexts = /* @__PURE__ */ new Set();
+  if (session.orgId) orgContexts.add(session.orgId);
+  if (session.org_id) orgContexts.add(session.org_id);
+  if (session.projectId) orgContexts.add(session.projectId);
+  orgContexts.add(null);
+  const docs = await RolePermissionModel.find({
+    orgId: { $in: Array.from(orgContexts) },
+    role: { $in: roles }
+  }).lean().exec();
+  const dynamic = /* @__PURE__ */ new Set();
+  for (const doc of docs) {
+    for (const perm of doc.permissions || []) {
+      if (perm) dynamic.add(perm);
+    }
+  }
+  const existing = Array.isArray(session.permissions) ? session.permissions : [];
+  session.permissions = Array.from(/* @__PURE__ */ new Set([...existing, ...dynamic]));
+}
 function requireAuth() {
   return async (req, res, next) => {
     try {
@@ -292,26 +321,32 @@ function requireAuth() {
         if (!user) {
           return res.status(401).json({ error: "User not found" });
         }
-        const session2 = buildSession({
+        const session = buildSession({
           sub: user.id.toString(),
           email: user.email,
-          roles: user.roles || []
+          roles: user.roles || [],
+          orgId: user.orgId,
+          org_id: user.orgId,
+          projectId: user.projectId
         });
-        session2.authType = "api-key";
-        session2.projectId = readProjectId(req) || user.projectId || void 0;
-        req.user = session2;
+        session.authType = "api-key";
+        session.projectId = readProjectId(req) || user.projectId || void 0;
+        await mergeRolePermissions(session);
+        req.user = session;
         return next();
+      } else {
+        const token = extractToken(req);
+        if (!token) {
+          return res.status(401).json({ error: "Missing token" });
+        }
+        const claims = await verifyJwt(token);
+        const session = buildSession(claims);
+        const pid = readProjectId(req);
+        if (pid) session.projectId = pid;
+        await mergeRolePermissions(session);
+        req.user = session;
+        next();
       }
-      const token = extractToken(req);
-      if (!token) {
-        return res.status(401).json({ error: "Missing token" });
-      }
-      const claims = await verifyJwt(token);
-      const session = buildSession(claims);
-      const pid = readProjectId(req);
-      if (pid) session.projectId = pid;
-      req.user = session;
-      next();
     } catch (e) {
       res.status(401).json({ error: e?.message || "Unauthorized" });
     }
@@ -365,8 +400,8 @@ function validateSendInvite(req, res, next) {
 }
 
 // src/models/invite.model.ts
-var import_mongoose2 = __toESM(require("mongoose"), 1);
-var InviteSchema = new import_mongoose2.default.Schema(
+var import_mongoose3 = __toESM(require("mongoose"), 1);
+var InviteSchema = new import_mongoose3.default.Schema(
   {
     id: { type: String, required: true, index: true },
     email: { type: String, required: true },
@@ -384,15 +419,15 @@ var InviteSchema = new import_mongoose2.default.Schema(
   },
   { timestamps: true, collection: "invites" }
 );
-var Invite = import_mongoose2.default.model("Invite", InviteSchema);
+var Invite = import_mongoose3.default.model("Invite", InviteSchema);
 
 // src/services/auth-admin.service.ts
 var import_bcrypt = __toESM(require("bcrypt"), 1);
 var import_jsonwebtoken2 = __toESM(require("jsonwebtoken"), 1);
 
 // src/models/client.model.ts
-var import_mongoose3 = __toESM(require("mongoose"), 1);
-var ClientSchema = new import_mongoose3.Schema(
+var import_mongoose4 = __toESM(require("mongoose"), 1);
+var ClientSchema = new import_mongoose4.Schema(
   {
     clientId: {
       type: String,
@@ -420,26 +455,7 @@ var ClientSchema = new import_mongoose3.Schema(
     timestamps: true
   }
 );
-var ClientModel = import_mongoose3.default.models.Client || import_mongoose3.default.model("Client", ClientSchema);
-
-// src/models/rolePermission.model.ts
-var import_mongoose4 = __toESM(require("mongoose"), 1);
-var RolePermissionSchema = new import_mongoose4.Schema(
-  {
-    orgId: { type: String, default: null, index: true },
-    role: { type: String, required: true },
-    permissions: { type: [String], default: [] }
-  },
-  {
-    timestamps: true
-  }
-);
-RolePermissionSchema.index({ orgId: 1, role: 1 }, { unique: true });
-var RolePermissionModel = import_mongoose4.default.model(
-  "RolePermission",
-  RolePermissionSchema,
-  "role_permissions"
-);
+var ClientModel = import_mongoose4.default.models.Client || import_mongoose4.default.model("Client", ClientSchema);
 
 // src/services/auth-admin.service.ts
 var AuthAdminService = class {
@@ -1033,16 +1049,18 @@ async function sendRateLimitedEmail({
   return { rateLimited: false };
 }
 function generateTokens(user) {
-  const accessToken = import_jsonwebtoken4.default.sign(
-    {
-      sub: user.id.toString(),
-      email: user.email,
-      roles: user.roles || [],
-      type: "user"
-    },
-    process.env.JWT_SECRET,
-    { expiresIn: "1h" }
-  );
+  const accessPayload = {
+    sub: user.id.toString(),
+    email: user.email,
+    roles: user.roles || [],
+    orgId: user.orgId || null,
+    org_id: user.orgId || null,
+    projectId: user.projectId || null,
+    type: "user"
+  };
+  const accessToken = import_jsonwebtoken4.default.sign(accessPayload, process.env.JWT_SECRET, {
+    expiresIn: "1h"
+  });
   const refreshToken = import_jsonwebtoken4.default.sign(
     { sub: user._id.toString() },
     process.env.JWT_SECRET,